Description
The qs module before 1.0.0 in Node.js does not call the compact function for array data, which allows remote attackers to cause a denial of service (memory consumption) by using a large index value to create a sparse array.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | node-qs | 2.2.4-1 | — |
| Debian 13 | node-qs | 2.2.4-1 | — |
| Debian 12 | node-qs | 2.2.4-1 | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Pro 14.04 LTS | node-qs | 0.6.5-1ubuntu0.1~esm1 | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 2 | nodejs010-node-gyp | 3.2.0-3.el6 | RHSA-2016:1380 |
| RHEL 2 | nodejs010-nodejs-qs | 0.6.5-5.el6 | RHSA-2016:1380 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| npm | qs | < 1.0.0 | 1.0.0 | GHSA-jjv7-qpx3-h62q |
Advisories 2
- RHSA-2016:1380 Red Hat Security Advisory: nodejs010-node-gyp and nodejs010-nodejs-qs security and bug fix update Red Hat Security Advisories (RHSA) · Jun 29, 2026
- WID-SEC-2024-1591 Juniper JUNOS: Mehrere Schwachstellen BSI CERT-Bund (WID) · Nov 11, 2024
References
- 60026 third-party-advisory
- 62170 third-party-advisory
- https://github.com/visionmedia/node-querystring/issues/104
- https://github.com/raymondfeng/node-querystring/commit/43a604b7847e56bba49d0ce3e222fe89569354d8
- RHSA-2016:1380 vendor-advisory
- https://nodesecurity.io/advisories/qs_dos_memory_exhaustion
- http://www-01.ibm.com/support/docview.wss?uid=swg21687928
- nodejs-cve20147191-dos(96729) vdb-entry
- http://www-01.ibm.com/support/docview.wss?uid=swg21685987
- http://www-01.ibm.com/support/docview.wss?uid=swg21687263